Cloudflare proposes keeping RX metadata alive through XDP

Tianyi Gao of Cloudflare has proposed a 15-patch series for bpf-next that lets an XDP program carry receive hash, VLAN tag and checksum status through to the socket buffer the kernel builds later. Today those fields come from the NIC descriptor that describes the packet before the program runs, and they do not survive what the program actually does to the packet.

On XDP_PASS the values go stale. After a program strips a UDP tunnel header, the stack still treats the outer checksum as unnecessary and applies that status to the inner packet. If the outer UDP checksum is zero, a packet with a bad inner checksum can reach the socket. On XDP_REDIRECT the values disappear: the skb that cpumap or veth builds from the redirected frame has no receive hash, no VLAN tag, and a checksum status of none.

Gao cites two costs. Redirecting into veth drops checksum status, so GRO verifies every checksum in software and, with one TCP flow, burns 34% of the receiving CPU. Load-balancing IPsec tunnel traffic with cpumap loses the receive hash, so GRO on cpumap puts every flow in the same bucket. In a cpumap test with 16 TCP flows and no IPsec, throughput was 17.6 Gbit/s instead of 23.4.

The series, building on a design suggested by Jesper Dangaard Brouer, reserves a small extension area in the packet headroom, just after the space used for the XDP frame. Programs write entries with new kfuncs, and the kernel copies them onto the skb when it is created after a redirect, or on pass in drivers that opt in. An entry occupies headroom only when stored, the area is capped at 64 bytes, and it needs no extra allocation. Checksum status may be set to none, or to unnecessary only after the program has verified the checksums, with a level up to the existing kernel maximum. Complete checksums are not forwarded to the stack for now.

AF_XDP zero-copy cannot use the stores: user space can rewrite that headroom while the program runs. Intel's ice driver and veth advertise a new skb-ext-pass feature so user space can tell whether a pass will honor the stored fields. Drivers that move the buffer start, including Freescale's DPAA parts, clear the marker so a redirect does not read garbage. Generic XDP and paths where an skb already exists warn and drop the stored values, because there is no later frame to rebuild from.